This message was deleted.
# citrix-vads
Slackbot
07/17/2023, 5:47 PMThis message was deleted.
h
Henry Heres
07/17/2023, 7:36 PMConfigure KCD and perhaps CBA as well for that
a
Arthur
07/18/2023, 3:18 AMCan you please provide more details?
h
Henry Heres
07/18/2023, 5:32 AMit's an IIS website, and for SSO you can configure that with kerberos constrained delegation, and for a dual factor enable e.g. certificate based authentication on it.
Henry Heres
07/18/2023, 5:33 AMor replace that one with SAML, haven't tried it with Director but it should work as well: Tutorial: Azure Active Directory single sign-on integration with Citrix ADC SAML Connector for Azure AD (Kerberos-based authentication) - Microsoft Entra | Microsoft Learn
b
Ben
07/18/2023, 7:25 AMIf you can live without having SSO and need MFA to reach the director page you can create a simple but not perfect solution. It would be basically the same as Henry posted, missing the KCD/SSO part. So nothing has to be adjusted on the IIS or machine accounts delegation.
• Create a Load Balancer for the Director and configure this with AAA-preauth with SAML.
• Create a dedicated Enterprise Application for the director Web App (If you are using Azure) and enforce MFA by Conditional Access policy binding
Technically you have 1FA on the IIS after MFA pre-auth but inside SSL. So i am not sure if it might be sufficient. Kind of fake MFA 🙂
j
Jeremy Saunders
07/18/2023, 8:05 AMNot sure how helpful this is, and I've never tried it myself, but got asked about implementing SAML2 authentication for my Self-Service Session Reset Tool. You could look at doing this at the IIS level using the Shibboleth ISAPI Filter, which is part of the Service Provider product and free for commercial use. There is plenty of helpful documentation on it.
2 Views